Wireless Fidelity (Wi-Fi) is a wireless local area network (WLAN) protocol compatible with IEEE Standard 802.11b or 802.11a that is used for wireless home and business networks, and at Wi-Fi “Hotspots” where wireless device users can connect to the Internet. As shown in FIG. 1, a conventional WLAN 100 is structured around a wireless access point (WAP) 101 that acts as a wireless network server, transmitting and receiving data, and providing connectivity, among wireless client devices 102-1 through 102-n. In addition, the WAP 101 serves as the point of interconnection between the WLAN 100 and a wired LAN 103. The WAP 101 can also serve as a gateway to a wide area network (WAN) 104, such as the Internet, in which case the WAP 101 may include a router core 105. To handle local traffic (i.e., traffic on the WLAN 100 and LAN 103), the router 105 examines each data packet header and determines, from an embedded physical address in each incoming message frame, which network port to forward the data. For incoming Internet traffic, the router uses a lookup table to associate a destination IP address with a hardware address on the local network. For outgoing Internet traffic, the router uses the lookup table to associate a hardware address on the local network with a source IP address in the Internet data packet header
As in the case of a wired LAN, each wireless device on the wireless network has a physical address and an assigned network address. The physical address is usually associated with a wireless network adapter or interface in the wireless device. Under the IEEE 802 Ethernet standard, the physical address is a 48-bit address known as the media access control (MAC) address. The first 24 bits of the address are an organization unique identifier (OUI), assigned by the IEEE, which uniquely identifies the manufacturer of the adapter. A manufacturer may have several different OUI's corresponding to different product lines or product types. The last 24 bits of the MAC address are administered by the hardware manufacturer and are used to identify a unique piece of hardware produced by the manufacturer. The 24 bits allow for 224 (more than 16 million) unique MAC addresses for each OUI. The 48 bits of the MAC address are usually grouped into six binary octets and written as a sequence of eight pairs of hexadecimal digits. In practice, the manufacturer of a wireless interface burns the 48-bit address into read only memory (ROM) on the wireless interface. As part of a network protocol, the WAP obtains the MAC address from the wireless device and creates a lookup table that maps the MAC address to an Internet address obtained from a DHCP (dynamic host configuration protocol) server.
In the IEEE 802.11 standard, a wireless network is identified by a service set identifier (SSID). The SSID is a label that distinguishes one wireless network from another, and all devices on the network should use the same SSID in order to establish communications. The WAP on a public network is normally configured to broadcast its SSID so that a wireless device searching for a network connection can discover it. The SSID broadcast allows a wireless adapter's client manager program or an operating system's built-in wireless software (e.g., Windows Zero Configuration software) to provide a list of the access points in range, or to automatically connect with an available access point by setting its own SSID to match. In contrast, the WAPs of private home and business WLANs are usually configured to suppress the SSID broadcast because the radio frequency signal transmitted by the WAP can travel through walls and other non-metallic barriers, and can be intercepted by unauthorized users outside of the home or business.
To provide an additional level of security against unauthorized access, private home and business networks normally encrypt the data that is transmitted and received by the WAP. The most common encryption scheme uses a Wired Equivalent Privacy (WEP) key to encrypt and decrypt data transmissions, providing a level of security equivalent to that of wired networks. WEP is a security protocol, specified in the IEEE Wi-Fi standard, 802.11b. In WEP encryption, a password is used in a hashing algorithm to generate a keyword, and the keyword is then used in another algorithm to encrypt and decrypt data. With WEP encryption, only those users with the right combination of SSID and keyword can establish a connection and communicate on the network.
In contrast to private home and business networks, a Wi-Fi hotspot is designed to provide public access to the Internet, sometimes for free and sometimes for a fee. The network SSID is broadcast by the WAP and the data transmissions are unencrypted so that any wireless device within range of the WAP can detect the SSID, configure its own SSID to match, and can then communicate on a clear (i.e., unencrypted) channel. However, accessing the Internet through a Wi-Fi hotspot usually requires an additional verification or authorization step where the user verifies that an access fee has been paid (e.g., as evidenced by a password) or actually pays an access fee in an online transaction. Until the verification or authorization step is completed, the wireless users are kept in a “walled garden.”
A walled garden refers to a limited browsing/network environment that controls the network resources, information, web sites and other Internet locations that a user is able to access. For example, when a hotel guest attempts to gain Internet access through the hotel's WAP, the guest will be redirected to a local web page (instead of his browser's home page). The local web page may request a password to verify a prior fee payment, or request some form of electronic payment or billing before the access is granted. Thereafter, for some limited time based on the fee paid, the guest may, for example, have unrestricted access to the Internet or remote access to peripherals (e.g., printers, scanners) in the hotel's business center.
A private home or business network operator may also want to provide limited public access to the Internet, or access to network resources, without compromising overall network security. For example, a homeowner may want to provide such access to a visitor or guest without revealing the network's SSID and security key, or a retail establishment may want to provide transient Internet access to its customers while maintaining security on its inventory and accounting records.
One approach used in the prior art is to provide two SSID's at the WAP, as shown in FIG. 2, which logically divides the access point into two virtual access points. In FIG. 2, two SSIDs (SSID1 and SSID2) at WAP 201 allow wireless devices 202 and 203 to access two different logical (virtual) or physical networks through a single wireless access point 201, and network managers can assign different access policies and functions for each SSID at the router 205. SSID1 can be assigned, for example, to LAN 204 and SSID2 can be assigned to LAN 206. LAN 204 can be configured as a public network, where its SSID1 will be broadcast, data transmissions will be unencrypted and users are placed in a walled garden 208 with controlled or restricted access to the Internet 207 and local network resources on LAN 204. LAN 206 can be configured as a private network, where its SSID2 will not be broadcast, data transmissions will be encrypted, and the network will only be accessible to those users with the correct SSID and encryption key.
The problem with both the walled garden approach and the dual SSID approach is that all users on a particular public network are treated the same way. Unlike a private network, where the network rights and privileges of each client can be individually set by the network administrator, there is no way to distinguish one wireless application or device from another on the public network. That is, the wireless access point does not detect what type of device or application is in use and is therefore unable to implement an access control policy based on the type of use.
One approach to this problem is to set up each type of use on a separate public VLAN, with a separate SSID and VLAN specific access policies. Consider, for example, a Wi-Fi network operator who wants to provide free Internet access for low bandwidth uses like text messaging or voice over Internet Protocol (VoIP) telephony, and fee-based access for high-bandwidth uses like web browsing, using a walled garden approach. A VLAN for each service would have to be set up, data rate policies would have to be established on each VLAN, and users would have to know the SSID of the VLAN corresponding to the service they want to use. Such a system could be costly and difficult to maintain, and confusing to potential users.